AWS European Sovereign Cloud vs. Microsoft Cloud for Sovereignty vs. OVHcloud: EU Data Residency Comparison
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
The CLOUD Act conflict with GDPR is not a theoretical concern: in 2023 and 2024, European data protection authorities issued fines and enforcement actions against organizations that transferred personal data to US-headquartered cloud providers without adequate supplementary safeguards. The core issue is that GDPR Article 46 requires legal mechanisms for transfers to third countries, and a US cloud provider's contractual commitments cannot override a lawful US government disclosure order. Structural solutions -- cloud offerings operated by EU-incorporated entities with no operational dependency on the US parent -- are the most defensible approach. For the broader cloud audit context that cloud sovereignty decisions sit within, see this AWS S3 security audit checklist.
AWS European Sovereign Cloud: Structural Separation Model
AWS European Sovereign Cloud (AWS ESC) reached general availability in January 2026. The core architecture is a physically and logically separate AWS infrastructure operated by Amazon Europe Core S.a.r.l., an EU-incorporated subsidiary. The sovereignty model rests on:
Structural separation: AWS ESC is operated independently from the global AWS commercial regions. AWS US personnel do not have routine access to AWS ESC infrastructure. This structural separation is the primary CLOUD Act mitigation: US law enforcement would need to compel Amazon Europe Core S.a.r.l. under EU law rather than using the CLOUD Act against the US parent.
Data residency: Customer data stays within the EU/EEA. AWS ESC does not transfer data to non-EU AWS regions for any purpose, including backup replication and support.
Operator access controls: Support access to customer environments requires explicit customer authorization and is logged. AWS ESC is pursuing German BSI C5 attestation under its operational structure.
Service coverage gaps: As of launch, AWS ESC does not offer the full AWS service catalog. Organizations that rely on specialized services (SageMaker, some database services) need to evaluate whether required services are available in AWS ESC or whether those workloads must remain in standard AWS EU regions.
Key limitation: AWS ESC is still operated by an Amazon subsidiary. The structural separation is a significant improvement over standard AWS EU regions, but it is not equivalent to a European-headquartered provider with no US corporate parent. Whether the structural separation is sufficient for specific regulatory requirements depends on the applicable data protection authority's interpretation.
Microsoft Cloud for Sovereignty: Configuration-Based Approach
Microsoft Cloud for Sovereignty (CSfS) takes a different architectural approach than AWS ESC: it is a configuration framework applied to existing Azure infrastructure rather than a separate cloud environment.
What CSfS provides:
- EU Data Boundary: A commitment from Microsoft that EU customer data for Microsoft 365 and Azure is stored and processed within the EU/EEA, with limited exceptions for security and safety operations
- Customer-managed keys: Azure Confidential Computing and Azure Key Vault customer-managed key (CMK) configurations ensure Microsoft cannot decrypt customer data without customer-controlled key material
- Sovereign landing zone templates: Infrastructure-as-code templates that configure Azure environments to restrict resource deployment to EU regions, enforce CMK policies, and restrict support access
- Policy guardrails: Azure Policy assignments that prevent data from leaving EU regions and enforce configuration standards
CLOUD Act independence: CSfS does not provide structural independence from US law. Microsoft is a US-headquartered company and remains subject to the CLOUD Act globally. The customer-managed key architecture provides a technical mitigation: even if Microsoft received a lawful disclosure order, it would not have the keys to decrypt customer data. However, this technical mitigation has not been tested against a US government disclosure order requiring key disclosure.
EU-operated sovereign cloud (Bleu, Cloud-Dew): Microsoft has partnerships with EU operators (Bleu in France, operated by Capgemini and Orange; Cloud-Dew in Germany) that operate Azure infrastructure under EU law. These partnership models provide stronger sovereignty guarantees than CSfS on standard Azure but have limited geographic availability.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
OVHcloud: EU-Headquartered Alternative
OVHcloud is a French-headquartered hyperscaler that operates sovereign cloud infrastructure under EU law, with no US corporate parent. Its sovereignty model is structural rather than configuration-based.
SecNumCloud qualification: OVHcloud's Hosted Private Cloud offering holds France's ANSSI SecNumCloud qualification, the most rigorous EU cloud security certification. SecNumCloud requires that the cloud provider is majority-EU owned, all data is processed in France, and the provider is not subject to laws of non-EU countries that could compel data disclosure.
CLOUD Act independence: Because OVHcloud is incorporated in France with no US parent company, it is not subject to the CLOUD Act. This is the strongest available structural protection against extraterritorial US government access.
EU cloud code of conduct: OVHcloud is certified under the European Cloud Code of Conduct (EU CoC), which provides a GDPR compliance framework recognized by EU data protection authorities.
Service coverage: OVHcloud does not match AWS or Azure in breadth of managed services. Organizations with heavy dependencies on AWS-native or Azure-native services (Lambda, DynamoDB, Azure AD, etc.) face significant refactoring to migrate to OVHcloud. OVHcloud's strength is IaaS (virtual machines, object storage, networking) and OpenStack-compatible services.
Pricing and support: OVHcloud is typically less expensive than AWS or Azure for equivalent compute and storage, but support SLAs and enterprise support model are less mature than the hyperscaler offerings.
CLOUD Act Independence: What Each Model Actually Provides
Security teams evaluating EU sovereign cloud offerings must understand what CLOUD Act independence each model actually provides:
AWS ESC: Partial structural independence. Amazon Europe Core S.a.r.l. is an EU subsidiary that could contest a US CLOUD Act order on grounds that EU law governs its operations. The legal defensibility of this structure has not been tested in court. Data protection authorities in Germany (where AWS ESC first launched) have indicated AWS ESC is an improvement but have not definitively ruled it CLOUD Act-independent.
Microsoft CSfS (standard Azure): No structural independence. Microsoft's customer-managed key architecture provides a technical mitigation: Microsoft cannot produce decrypted data because it does not hold the keys. However, the US government could potentially compel Microsoft to cooperate with a key seizure or mandate a key escrow mechanism.
Microsoft CSfS (via EU operator partnerships): Stronger independence. Bleu (France) and Cloud-Dew (Germany) operate Azure infrastructure as independent EU entities. The legal relationship between Microsoft and these operators is structured to minimize CLOUD Act exposure, though Microsoft's underlying technology involvement is a remaining concern.
OVHcloud: Strongest structural independence. No US corporate parent, no US law applicability. CLOUD Act does not apply. This is the most defensible option for workloads where CLOUD Act exposure is a hard requirement.
Practical guidance: For public sector workloads in France with SecNumCloud requirements, OVHcloud is the only qualified option. For regulated industries that need a broad service catalog with strong (but not absolute) CLOUD Act mitigation, AWS ESC is the best current hyperscaler option. For Microsoft 365-dependent organizations, the EU Data Boundary combined with CMK configuration is the available path, with EU operator partnership models available in France and Germany for higher assurance requirements.
Regulatory Certifications Comparison
EU sovereign cloud certifications and their regulatory implications:
| Certification | AWS ESC | Microsoft CSfS | OVHcloud |
|---|---|---|---|
| BSI C5 | In progress | Yes (standard Azure EU) | No |
| ISO 27001 | Yes | Yes | Yes |
| ANSSI SecNumCloud | No | No (Bleu only) | Yes |
| EU Cloud CoC | In progress | Yes | Yes |
| GDPR adequacy | Contractual | Contractual + CMK | Structural |
SecNumCloud is the most demanding certification and effectively limits qualified providers to EU-headquartered operators (OVHcloud, Thales/S3NS, Bleu). It is required for certain French public sector workloads and is increasingly referenced in EU critical infrastructure requirements.
BSI C5 (German Federal Office for Information Security Cloud Computing Compliance Criteria Catalogue) is required for many German public sector workloads and is a de facto standard for regulated industries in Germany.
EU Cloud CoC provides a GDPR compliance framework that simplifies data processing agreement requirements between organizations and certified cloud providers.
Migration and Operational Considerations
Migrating workloads from standard AWS or Azure regions to sovereign cloud offerings requires planning for service coverage gaps and operational model changes:
Service coverage gaps:
- AWS ESC does not offer the full AWS service catalog. Before migration planning, inventory all AWS services in use and confirm availability in AWS ESC.
- OVHcloud does not support AWS-native or Azure-native managed services. Migration requires refactoring or replacing service dependencies.
Identity and access management:
- AWS ESC uses a separate IAM boundary from standard AWS. Existing AWS IAM roles, policies, and permission sets must be recreated.
- OVHcloud uses Keystone (OpenStack) or its own IAM, depending on the service. IAM migration is a significant project for organizations moving from AWS or Azure.
Data migration:
- Cross-region data migration within AWS from standard EU regions to AWS ESC is possible but requires careful handling of transfer policies and data residency during the migration window.
- Migration to OVHcloud from AWS or Azure requires exporting data from the source cloud and importing to OVHcloud, with transit handling for GDPR compliance.
Cost:
- AWS ESC carries a premium over standard AWS EU regions (estimated 10-15% higher for equivalent services).
- OVHcloud is generally less expensive than AWS or Azure for IaaS workloads, partially offsetting refactoring costs.
The bottom line
The choice between AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty, and OVHcloud depends on the specific regulatory requirement and the acceptable level of CLOUD Act exposure. OVHcloud provides the strongest structural independence but requires significant service refactoring for organizations that rely on AWS or Azure-native services. AWS ESC provides the best available combination of hyperscaler service breadth and structural CLOUD Act mitigation for AWS-dependent workloads, with the caveat that its legal independence from the US parent has not been definitively tested. Microsoft CSfS on standard Azure provides technical mitigation (CMK) but no structural independence; the EU operator partnership models (Bleu, Cloud-Dew) provide stronger guarantees for French and German workloads respectively. For the SASE and cloud network architecture context that sovereign cloud deployments affect, see this SASE architecture implementation guide.
Frequently asked questions
When did AWS European Sovereign Cloud reach general availability?
AWS European Sovereign Cloud reached general availability in January 2026. It launched in Germany (Frankfurt) initially, with additional EU locations planned. It is a physically and logically separate cloud environment from the standard AWS EU-Frankfurt and EU-Ireland regions, operated by Amazon Europe Core S.a.r.l., an EU-incorporated subsidiary designed to minimize exposure to US CLOUD Act jurisdiction.
Does Microsoft Azure comply with GDPR data residency requirements?
Standard Microsoft Azure EU regions (West Europe, North Europe, Germany West Central, etc.) can comply with GDPR data residency through the EU Data Boundary commitment, which restricts personal data processing to EU/EEA regions. However, standard Azure does not provide CLOUD Act independence because Microsoft is a US-headquartered company subject to US extraterritorial law. Customer-managed key (CMK) configurations add a technical mitigation: Microsoft cannot decrypt customer data without customer-controlled key material. For stronger independence, Microsoft's EU operator partnerships (Bleu in France, Cloud-Dew in Germany) operate Azure infrastructure under EU law.
What is ANSSI SecNumCloud and which cloud providers are qualified?
SecNumCloud is France's national cloud security qualification issued by ANSSI (Agence nationale de la securite des systemes d'information). It is the most rigorous EU cloud security certification and requires that the provider is majority-EU owned, all data processing occurs in France, and the provider is not subject to non-EU laws that could compel data disclosure. As of 2026, SecNumCloud-qualified providers include OVHcloud (Hosted Private Cloud), Thales/S3NS, and Bleu (Microsoft Azure operated by Capgemini and Orange). Standard AWS and Azure are not SecNumCloud qualified.
What is the CLOUD Act and why does it matter for GDPR compliance?
The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) allows US law enforcement to compel US-headquartered companies to produce data stored anywhere in the world, including data stored in EU data centers. This creates a tension with GDPR, which restricts personal data transfers to countries without adequate protection and requires legal mechanisms for such transfers. If a US cloud provider complies with a CLOUD Act order and produces EU personal data to US law enforcement without an EU-approved legal basis, that transfer may violate GDPR. Structural solutions (EU-incorporated cloud operators with no US parent) are the most legally defensible approach.
Is OVHcloud a suitable alternative to AWS or Azure for enterprise workloads?
OVHcloud is a suitable alternative for workloads that rely primarily on IaaS capabilities (virtual machines, object storage, networking) and OpenStack-compatible managed services. It is not a suitable drop-in replacement for organizations with heavy dependencies on AWS-native services (Lambda, DynamoDB, SageMaker) or Azure-native services (Azure AD, Azure Functions, Cosmos DB), as OVHcloud does not offer equivalents for many of these services. The refactoring investment to migrate AWS- or Azure-native workloads to OVHcloud is significant and must be weighed against the sovereignty benefit.
What is the EU Cloud Code of Conduct and what does certification mean?
The European Cloud Code of Conduct (EU CoC) is a GDPR compliance framework for cloud providers, supervised by the Belgian Data Protection Authority. Cloud providers certified under the EU CoC have committed to specific data protection practices mapped to GDPR requirements, and their compliance is independently audited. For organizations that use EU CoC-certified providers, the data processing agreement (DPA) requirement under GDPR Article 28 is simplified because the provider's certified practices map to the required DPA terms. AWS, Microsoft, Google, and OVHcloud are all EU CoC certified.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.